There is heap-based buffer overflow in Linux kernel, all versions up to, excluding 5.3, in the marvell wifi chip driver in Linux kernel, that allows local users to cause a denial of service(system crash) or possibly execute arbitrary code.
CVE-2019-14814
HIGHNVD 7.87.8—
EchelonGraph scoreMEDIUM confidence
Score 7.8 from GitHub Security Advisory (severity: HIGH) published 2022-05-24. NVD baseline CVSS 7.8; sources differ by 0.0.
Triggered by: GitHub Security Advisory CVSS
Sources: epss, ghsa, nvd
7.8EG
EchelonGraph verdictPlan a fixSerious severity, but no confirmed exploitation yet.
- High severity, but no confirmed exploitation yet
CISA-KEV: Not listedEPSS PROB: 1%CVSS: 7.8Exploit: None knownExposed: 0
A fix is available — apply it.
- CVSS v3
- 7.8
- EG Score
- 7.8(medium)
- EG Risk
- 40(Track)EG Risk 40/100SSVC: Track
EG Risk is EchelonGraph's 0–100 priority score: it fuses intrinsic severity with real-world exploitation and automatability so you can rank equal-severity CVEs and fix the most dangerous first. Higher = act sooner. Distinct from the 0–10 EG Score (severity).
How it’s computedSeverity78% × 45%Exploitation1% × 40%Automatability30% × 15%Action: Routine — remediate on your standard cadence. - EPSS PROB
- 1%
- EPSS %ILE
- 57%
- KEV
- Not listed
Published
September 20, 2019
Last Modified
November 21, 2024
References (48)
- secalert@redhathttp://lists.opensuse.org/opensuse-security-announce/2019-09/msg00064.html
- secalert@redhathttp://lists.opensuse.org/opensuse-security-announce/2019-09/msg00066.html
- secalert@redhathttp://packetstormsecurity.com/files/154951/Kernel-Live-Patch-Security-Notice-LSN-0058-1.html
- secalert@redhathttp://packetstormsecurity.com/files/155212/Slackware-Security-Advisory-Slackware-14.2-kernel-Updates.html
- secalert@redhathttp://www.openwall.com/lists/oss-security/2019/08/28/1
- secalert@redhathttps://access.redhat.com/errata/RHSA-2020:0174
- secalert@redhathttps://access.redhat.com/errata/RHSA-2020:0328
- secalert@redhathttps://access.redhat.com/errata/RHSA-2020:0339
- secalert@redhathttps://access.redhat.com/security/cve/cve-2019-14814
- secalert@redhathttps://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14814
- secalert@redhathttps://github.com/torvalds/linux/commit/7caac62ed598a196d6ddf8d9c121e12e082cac3a
- secalert@redhathttps://lists.debian.org/debian-lts-announce/2019/09/msg00025.html
- secalert@redhathttps://lists.debian.org/debian-lts-announce/2020/03/msg00001.html
- secalert@redhathttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/O3RUDQJXRJQVGHCGR4YZWTQ3ECBI7TXH/
- secalert@redhathttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/T4JZ6AEUKFWBHQAROGMQARJ274PQP2QP/
Vendor Advisories for CVE-2019-14814(1)
These vendors published their own advisory mentioning this CVE — often with vendor-specific remediation steps + affected product lists not in NVD.
Patch Availability(10)
| Vendor / Ecosystem | Fixed in / Patch | Released | Source |
|---|---|---|---|
| ubuntu | linux-image-virtual-lts-xenial (4.4.0.166.174) @ xenial | 2026-05-27 | ubuntu |
| ubuntu | linux-image-azure (4.15.0.1061.47) @ trusty | 2026-05-27 | ubuntu |
| ubuntu | linux-image-virtual (5.0.0.32.33) @ disco | 2026-05-27 | ubuntu |
| ubuntu | linux-image-virtual-hwe-18.04 (5.0.0.32.89) @ bionic | 2026-05-27 | ubuntu |
| ubuntu | linux-image-4.4.0-166-powerpc-e500mc (4.4.0-166.195~14.04.1) @ trusty | 2026-05-27 | ubuntu |
| ubuntu | linux-image-virtual-hwe-16.04-edge (4.15.0.66.68) @ bionic | 2026-05-27 | ubuntu |
| redhat | kernel-0:3.10.0-1127.el7 | 2020-03-31 | redhat |
| redhat | kernel-rt-0:4.18.0-147.5.1.rt24.98.el8_1 | 2020-02-04 | redhat |
| redhat | kernel-0:4.18.0-147.5.1.el8_1 | 2020-02-04 | redhat |
| redhat | kernel-alt-0:4.14.0-115.17.1.el7a | 2020-01-21 | redhat |
Patches are aggregated from vendor advisories (Red Hat, Microsoft, Cisco, GitHub) and package ecosystems (OSV, GHSA). Multiple rows for the same upstream release have been deduplicated.
Affected Packages
(6 across 5 ecosystems)
Debian:8(2)
| Package | Vulnerable range | Fixed in | Dependents |
|---|---|---|---|
| linux | 3.16.36-1 ... 3.16.72-1 (67 versions) | 3.16.74-1 | — |
| linux-4.9 | 4.9.110-1~deb8u1, 4.9.144-3.1~deb8u1, 4.9.168-1~deb8u1, 4.9.189-3~deb8u1 | 4.9.210-1~deb8u1 | — |
Debian:11(1)
| Package | Vulnerable range | Fixed in | Dependents |
|---|---|---|---|
| linux | — | 5.2.17-1 | — |
Debian:12(1)
| Package | Vulnerable range | Fixed in | Dependents |
|---|---|---|---|
| linux | — | 5.2.17-1 | — |
Debian:13(1)
| Package | Vulnerable range | Fixed in | Dependents |
|---|---|---|---|
| linux | — | 5.2.17-1 | — |
Debian:14(1)
| Package | Vulnerable range | Fixed in | Dependents |
|---|---|---|---|
| linux | — | 5.2.17-1 | — |
Weakness Classification(2)
MITRE Common Weakness Enumeration — the root-cause categories this CVE belongs to.
Additional Vendor Advisories
(9)
Vendors that published advisories for this CVE beyond the curated set above. Broader coverage but minimal per-row detail — click through for the original advisory.
- Red HatRHSA-2020:0174MODERATE2019-08-28
RHSA-2020:0174 — Moderate
- Red HatRHSA-2020:0328MODERATE2019-08-28
RHSA-2020:0328 — Moderate
- Red HatRHSA-2020:0339MODERATE2019-08-28
RHSA-2020:0339 — Moderate
- UbuntuUSN-4157-1MEDIUM
Linux kernel vulnerabilities
- UbuntuUSN-4157-2MEDIUM
Linux kernel (HWE) vulnerabilities
- UbuntuUSN-4162-1MEDIUM
Linux kernel vulnerabilities
- UbuntuUSN-4162-2MEDIUM
Linux kernel (Azure) vulnerabilities
- UbuntuUSN-4163-1MEDIUM
Linux kernel vulnerabilities
- UbuntuUSN-4163-2MEDIUM
Linux kernel (Xenial HWE) vulnerabilities
Frequently asked(5)
What is CVE-2019-14814?
CVE-2019-14814 is a high vulnerability published on September 20, 2019. There is heap-based buffer overflow in Linux kernel, all versions up to, excluding 5.3, in the marvell wifi chip driver in Linux kernel, that allows local users to cause a denial of service(system crash) or possibly execute arbitrary code.
When was CVE-2019-14814 disclosed?
CVE-2019-14814 was first published in the National Vulnerability Database on September 20, 2019, with the most recent update on November 21, 2024. EchelonGraph re-ingests CVE updates from NVD on a 2-hour cycle, so this page reflects the latest published state.
Is CVE-2019-14814 actively exploited?
CVE-2019-14814 is not currently on CISA's Known Exploited Vulnerabilities catalog. FIRST EPSS estimates a 1% probability of exploitation in the next 30 days, which ranks it in the top 42.8% of all scored CVEs.
What is the CVSS score of CVE-2019-14814?
CVE-2019-14814 has a CVSS v3 base score of 7.8 (NVD).
How do I remediate CVE-2019-14814?
Patch to the fixed version published by the affected vendor. Where vendor advisories exist for CVE-2019-14814, EchelonGraph cross-links them in the Vendor Advisories panel below — those typically contain the canonical remediation steps, fixed version numbers, and any vendor-specific mitigations.
Dependency Blast Radius
See which npm, PyPI, Go, and Maven packages are affected by CVE-2019-14814
Is Your Infrastructure Affected by CVE-2019-14814?
EchelonGraph automatically scans your cloud infrastructure and maps CVE exposure using blast radius analysis.